41 lines
1014 B
Ruby
41 lines
1014 B
Ruby
class Api::SessionsController < ApplicationController
|
|
skip_before_action :authenticate_request!, only: [:create]
|
|
|
|
def create
|
|
user = if params[:nickname].present? && params[:password].present?
|
|
User.authenticate_by(params.permit(:nickname, :password))
|
|
end
|
|
|
|
if user
|
|
token = JwtService.encode(user_id: user.id)
|
|
render json: {
|
|
user: user_response(user),
|
|
token: token
|
|
}
|
|
else
|
|
render json: { error: "Invalid nickname or password" }, status: :unauthorized
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
# JWT is stateless; client should discard the token.
|
|
# For server-side revocation, implement a token blacklist here.
|
|
render json: { message: "Signed out successfully" }
|
|
end
|
|
|
|
def me
|
|
render json: { user: user_response(current_user) }
|
|
end
|
|
|
|
private
|
|
|
|
def user_response(user)
|
|
{
|
|
id: user.id,
|
|
nickname: user.nickname,
|
|
avatar_url: user.avatar.attached? ? url_for(user.avatar) : nil,
|
|
created_at: user.created_at
|
|
}
|
|
end
|
|
end
|